A vulnerability was discovered by X-Force Research at ISS in
ProFTPD's handling of ASCII translation. An attacker, by
downloading a carefully crafted file, can remotely exploit this bug
to create a root shell.

The ProFTPD team encourages all users to upgrade to version
1.2.7 or higher. The problematic code first appeared in ProFTPD
1.2.7rc1, and the provided packages are all patched by the ProFTPD
team to protect against this vulnerability.

Update:

The previous update had a bug where the new packages would
terminate with a SIGNAL 11 when the command "NLST -alL" was
performed in certain cases, such as if the size of the output of
the command was greater than 1024 bytes.